Claim your CPD points
The concept of risk culture has been around for a long time but has been increasingly in the spotlight.
APRA defines risk culture as "the behavioural norms and practices of individuals and groups that shape an entity's ability to identify, understand, openly discuss, escalate and act on its current and emerging risks." [1]
The topic comes up regularly in industry and profession forums and in my conversations with directors and other professionals, risk culture is undeniably a fundamental pillar of risk management, and intrinsically linked to the overall culture of an organisation.
As a Chief Risk Officer, I have been exploring storytelling as a tool to enhance risk culture and recently presented this idea at the 2024 All-Actuaries Summit.
We face risks every day, both in professional and personal life. As someone who thinks a lot about risk, I have categorised the time horizons of management of risk into three areas as shown below.
Storytelling has existed for generations in many cultures as a way to pass on knowledge. It is an integral part of Australian Indigenous culture and has formed the basis for many biblical lessons, as well.
Storytelling brings emotion into learning, and I use it every week as an ethics teacher to Year 4 pupils, where volunteers are asked to bring the stories and scenarios to life and create a sense of curiosity about the questions they pose. [2]
While there are thousands of stories around, the approach to telling them is critical to help an audience understand the characters and circumstances, and ultimately remember and learn from these examples.
Eleanor Roosevelt once said, "Learn from the mistakes of others. You can't live long enough to make them all yourself".
From this idea, I suggest that an improved culture can be achieved if a risk function can:
Over the past few years, I've been able to explore and discuss many interesting "stories", including:
In all these cases, the apparent ethics and values have shone through. Were these caused by weaknesses in individual behaviours, failures of the organisational structure and/or culture? Or was the regulatory framework part of the issue?
A key advantage of going deeper into a story is an ability to allow different personality types to be grounded in the facts and events which occurred, enabling greater agreement on any steps to be taken.
An example of this is the regular occurrence of "Sydney Shark Attack!!" headlines in the news where individual reactions can vary from:
"I'm never going in the water again" to "It ain't gonna happen to me! We're in Australia, so what do you expect?"
Going below the headline and exploring the risks and potential actions can align some of these natural reactions and end up with a more balanced (and likely more appropriate) course of action to decide when and where to next risk going for a surf.
There are similar learnings possible in the financial services industry when headlines about data breaches or APRA/ASIC interventions are seen, with the risk function able to lead a discussion through what actually happened and the "risk lesson" emerging from it. This encourages all employees to think more about risk and be proactive in speaking up and interacting with the risk department.
Storytelling is more than just reacting to what has gone wrong. Time is needed to research, prepare and then tell the stories, and so support is needed from the organisation for this concept to succeed.
In addition, storytelling may not be the most natural skill set for actuaries. It is not something which is tested in exams or part of most people's jobs. However, many actuaries already approach challenges with energy and inner confidence and engage in discussions on how to "do the right thing". Thinking through how our moral compass will direct us, were we to be in these stories, has always been a key part of our profession.
Therefore, I encourage others to embrace the art of storytelling. It has been a source of great pleasure for me recently and I have seen evidence that it can be successful in building trust and respect within the risk culture of an organisation.
If you would like to hear more or have stories on risk culture that you would like to share with me, please reach out .
[1] Australian Prudential Regulation Authority. (n.d.). Transforming risk culture: Observations from APRA's pilot survey. https://www.apra.gov.au/transforming-risk-culture-observations-from-apra%E2%80%99s-pilot-survey#what-is-risk-cultureg
[2] Primary Ethics. (n.d.). Primary Ethics. https://primaryethics.com.au/